dcb8d73a60b84dc0f10048cd00f013fd81601e9b0a47ecf5df32ddc0cb117f06 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 10:25

Sharing

Report Analysis Logs

General

Target

SOA 820527940511.cmd.exe
Size

1.1MB
MD5

94176afdf3dfa9f3d145cedbc0128c70
SHA1

156be08e77a37f3faa48ca039e27b555429005b1
SHA256

dcb8d73a60b84dc0f10048cd00f013fd81601e9b0a47ecf5df32ddc0cb117f06
SHA512

79c624293a58a220f2e8157abfbdfcb233bc484f967f1c3dc18ef20ff9673cb82cb76098123c4305cbacf37892ca822df920402a4e07451b9fd71ff50d9a6c1e
SSDEEP

24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aa2O2EqCJWS8YGuITOeN:yTvC/MTQYxsWR7aa2AxHAO

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

SOA 820527940511.cmd.exe

pid process

2184 SOA 820527940511.cmd.exe
2184 SOA 820527940511.cmd.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

SOA 820527940511.cmd.exe

pid process

2184 SOA 820527940511.cmd.exe
2184 SOA 820527940511.cmd.exe

C:\Users\Admin\AppData\Local\Temp\SOA 820527940511.cmd.exe
"C:\Users\Admin\AppData\Local\Temp\SOA 820527940511.cmd.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-10-0x0000000000620000-0x0000000000624000-memory.dmp

Filesize
16KB

Download